You can change the UA Profile URL all day and it really won't matter unless you change the UA String. Swirly changes two things when you spoof the User-Agent, the UA String, and the UA Profile. I'm pretty sure the UA String is all that T-Mobile is paying attention to.
OS 3.0 currently sends User-Agent: iPhoneOS/3.0 (7A341).
The 3.0 and the 7A341 can be changed in System Version.plist, but the iPhoneOS part appears to be pulling from somewhere else.
Stock MMS Headers
X-Wap-Profile:
http://www.apple.com/mms/uaprof.rdf
Accept-Charset: *
Accept: application/vnd.wap.mms-message
Accept-Language: *
Accept-Encoding: identity
User-Agent: iPhoneOS/3.0 (7A341)
Connection: close
Proxy-Connection: close
MMS Headers with OS changed in System Version.plist, similar results for build, but no go on the IPhoneOS part.
X-Wap-Profile:
http://www.apple.com/mms/uaprof.rdf
Accept-Charset: *
Accept: application/vnd.wap.mms-message
Accept-Language: *
Accept-Encoding: identity
User-Agent: iPhoneOS/3.1 (7A341)
Connection: close
Proxy-Connection: close
Even if everything could be changed in System Version.plist I'm not really sure what effect it would have on the phone as a whole. Most likely someone is going to have to hack the binary responsible for building the headers.